ALAS2-2023-2057

References: CVE-2021-46657  CVE-2021-46659  CVE-2021-46661  CVE-2021-46663  CVE-2021-46666  CVE-2021-46667  CVE-2021-46668  CVE-2022-27380  CVE-2022-27384  CVE-2022-31624 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. (CVE-2021-46657)

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW. (CVE-2021-46659)

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE). (CVE-2021-46661)

MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements. (CVE-2021-46663)

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause. (CVE-2021-46666)

An integer overflow vulnerability was found in MariaDB, where an invalid size of ref_pointer_array is allocated. This issue results in a denial of service. (CVE-2021-46667)

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures. (CVE-2021-46668)

An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. (CVE-2022-27380)

An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. (CVE-2022-27384)

MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock. (CVE-2022-31624)

Issue Correction:
Run yum update mariadb to update your system.

New Packages:

aarch64:
    mariadb-5.5.68-1.amzn2.0.1.aarch64
    mariadb-libs-5.5.68-1.amzn2.0.1.aarch64
    mariadb-server-5.5.68-1.amzn2.0.1.aarch64
    mariadb-devel-5.5.68-1.amzn2.0.1.aarch64
    mariadb-embedded-5.5.68-1.amzn2.0.1.aarch64
    mariadb-embedded-devel-5.5.68-1.amzn2.0.1.aarch64
    mariadb-bench-5.5.68-1.amzn2.0.1.aarch64
    mariadb-test-5.5.68-1.amzn2.0.1.aarch64
    mariadb-debuginfo-5.5.68-1.amzn2.0.1.aarch64

i686:
    mariadb-5.5.68-1.amzn2.0.1.i686
    mariadb-libs-5.5.68-1.amzn2.0.1.i686
    mariadb-server-5.5.68-1.amzn2.0.1.i686
    mariadb-devel-5.5.68-1.amzn2.0.1.i686
    mariadb-embedded-5.5.68-1.amzn2.0.1.i686
    mariadb-embedded-devel-5.5.68-1.amzn2.0.1.i686
    mariadb-bench-5.5.68-1.amzn2.0.1.i686
    mariadb-test-5.5.68-1.amzn2.0.1.i686
    mariadb-debuginfo-5.5.68-1.amzn2.0.1.i686

src:
    mariadb-5.5.68-1.amzn2.0.1.src

x86_64:
    mariadb-5.5.68-1.amzn2.0.1.x86_64
    mariadb-libs-5.5.68-1.amzn2.0.1.x86_64
    mariadb-server-5.5.68-1.amzn2.0.1.x86_64
    mariadb-devel-5.5.68-1.amzn2.0.1.x86_64
    mariadb-embedded-5.5.68-1.amzn2.0.1.x86_64
    mariadb-embedded-devel-5.5.68-1.amzn2.0.1.x86_64
    mariadb-bench-5.5.68-1.amzn2.0.1.x86_64
    mariadb-test-5.5.68-1.amzn2.0.1.x86_64
    mariadb-debuginfo-5.5.68-1.amzn2.0.1.x86_64